3 ms·

> there's no guarantee that the shipped binary packages can be built with the shipped toolchain or shipped dependencies. That problem will be with us as long a

by ryao 11y ago

> there's no guarantee that the shipped binary packages can be built with the shipped toolchain or shipped dependencies. That problem will be with us as long as we use binaries as the primary means of distribution. If you consider that to be a problem, you could put effort into distributions where the packaging is the source code. I know I do. > Because it's entirely unnecessary? Building the entire archive is a huge amount of effort. How do you know that the source code provided actually corresponds to the binaries unless you compile them yourself[ with a toolchain you compiled yourself [...]]? > The terms are at http://www.ubuntu.com/legal/terms-and-policies/intellectual-.. http://www.ubuntu.com/legal/terms-and-policies/intellectual-.... - I probably should have linked them, I've just been writing about this enough lately that it's easy to forget that people might read a single post without context. No company's policies are perfect. You might be more effective trying to deal with the overall distribution of how software is done rather than imperfections in community leaders. There is a point of diminishing returns in focusing on a small subset of the companies out there while completely ignoring the rest.

wantreprenr007 11y ago
Reproducibility from source and build env are fundamental to science or making changes to improve something. Without these, it can appear to signal hoarded proprietariness waving the banner of FLOSS or just a poorly-maintained project without high standards, even if it were unintentional.
- ryao 11y ago
  > Reproducibility from source and build env are fundamental to science or making changes to improve something. Without these, it can appear to signal hoarded proprietariness waving the banner of FLOSS or just a poorly-maintained project without high standards, even if it were unintentional. I am typing this on a system running Gentoo that has only 3 proprietary packages installed, with one being Intel's microcode. In time, I hope to lower that number to zero. If you are concerned about this and do not run a source-based distribution, I suggest that you switch.
  - majewsky 11y ago
    Source-based distributions are not the only solution. >> https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
    - ryao 11y ago
      That requires making the builds easy to do, such that Matthew's claim that people cannot easily build things themselves probably is not valid. At least not if that project succeeds. Anyway, I am happy to see that building from source is becoming easier for users of Debian and presumably Ubuntu by extension.
mjg59 11y ago
> If you consider that to be a problem I do consider it to be a problem, but since reality is problematic I think policies that force people to rebuild all binaries before they can redistribute them are harmful. > How do you know that the source code provided actually corresponds to the binaries unless you compile them yourself[ with a toolchain you compiled yourself [...]]? I don't, but I also don't have a verifiable path to bootstrapping a toolchain. I trust that Canonical haven't backdoored their packages. > You might be more effective trying to deal with the overall distribution of how software is done rather than imperfections in community leaders. I'm interested in it being straightforward for people to produce modified derivatives of the market leader, ie Ubuntu. I can achieve that in two ways: 1) Helping convince Canonical to change their IP policy 2) Helping convince Canonical to rearchitect their entire distribution infrastructure (1) strikes me as being easier, so that's what I've chosen to work on.
- pekk 11y ago
  If you are looking at some repository for Ubuntu's source code, and find that their build process isn't perfectly documented as regards the version of gcc they use, that really isn't a GPL violation no matter how hard you try to claim that it is. You don't have a moral right to base a distribution on binaries produced by some other distribution. Unless you are going to produce actual evidence of a legal violation you really don't have anything here.
  - mjg59 11y ago
    Not sure whether this was aimed at me, but I don't believe that having source be difficult to build is a GPL violation.
- ryao 11y ago
  > I don't, but I also don't have a verifiable path to bootstrapping a toolchain. I trust that Canonical haven't backdoored their packages. You do not need a verifiable path to bootstrapping a toolchain to reduce surface area of attack to just the toolchain. That being said, you could try building Clang with GCC and then GCC with Clang (or vice versa) to break any exploits designed to persist in either one indefinitely unless you are the victim of a really special hypothetical attack that targets both simultaneously, although I imagine you could interleave multiple GCC and Clang versions to make such an attack even harder to pull off or even add more compilers to the mix like EKOPath. That should reduce the attack surface area to binutils.

by ryao 11y ago

wantreprenr007 11y ago

Reproducibility from source and build env are fundamental to science or making changes to improve something. Without these, it can appear to signal hoarded proprietariness waving the banner of FLOSS or just a poorly-maintained project without high standards, even if it were unintentional.

ryao 11y ago
> Reproducibility from source and build env are fundamental to science or making changes to improve something. Without these, it can appear to signal hoarded proprietariness waving the banner of FLOSS or just a poorly-maintained project without high standards, even if it were unintentional. I am typing this on a system running Gentoo that has only 3 proprietary packages installed, with one being Intel's microcode. In time, I hope to lower that number to zero. If you are concerned about this and do not run a source-based distribution, I suggest that you switch.
- majewsky 11y ago
  Source-based distributions are not the only solution. >> https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
  - ryao 11y ago
    That requires making the builds easy to do, such that Matthew's claim that people cannot easily build things themselves probably is not valid. At least not if that project succeeds. Anyway, I am happy to see that building from source is becoming easier for users of Debian and presumably Ubuntu by extension.

mjg59 11y ago

> If you consider that to be a problem I do consider it to be a problem, but since reality is problematic I think policies that force people to rebuild all binaries before they can redistribute them are harmful. > How do you know that the source code provided actually corresponds to the binaries unless you compile them yourself[ with a toolchain you compiled yourself [...]]? I don't, but I also don't have a verifiable path to bootstrapping a toolchain. I trust that Canonical haven't backdoored their packages. > You might be more effective trying to deal with the overall distribution of how software is done rather than imperfections in community leaders. I'm interested in it being straightforward for people to produce modified derivatives of the market leader, ie Ubuntu. I can achieve that in two ways: 1) Helping convince Canonical to change their IP policy 2) Helping convince Canonical to rearchitect their entire distribution infrastructure (1) strikes me as being easier, so that's what I've chosen to work on.

pekk 11y ago
If you are looking at some repository for Ubuntu's source code, and find that their build process isn't perfectly documented as regards the version of gcc they use, that really isn't a GPL violation no matter how hard you try to claim that it is. You don't have a moral right to base a distribution on binaries produced by some other distribution. Unless you are going to produce actual evidence of a legal violation you really don't have anything here.
- mjg59 11y ago
  Not sure whether this was aimed at me, but I don't believe that having source be difficult to build is a GPL violation.
ryao 11y ago
> I don't, but I also don't have a verifiable path to bootstrapping a toolchain. I trust that Canonical haven't backdoored their packages. You do not need a verifiable path to bootstrapping a toolchain to reduce surface area of attack to just the toolchain. That being said, you could try building Clang with GCC and then GCC with Clang (or vice versa) to break any exploits designed to persist in either one indefinitely unless you are the victim of a really special hypothetical attack that targets both simultaneously, although I imagine you could interleave multiple GCC and Clang versions to make such an attack even harder to pull off or even add more compilers to the mix like EKOPath. That should reduce the attack surface area to binutils.